CVE-2024-50009

What it actually does

NULL pointer dereference in Linux kernel amd-pstate cpufreq driver when cpufreq_cpu_get returns NULL without a prior check.

Why it matters to the business

Potential kernel crashes or system instability on AMD-based Linux systems during CPU frequency management operations, causing unplanned downtime.

How an attack unfolds

An attacker with local access on an affected AMD system triggers the amd-pstate code path where cpufreq_cpu_get returns NULL, leading to a dereference and potential denial of service; no widespread exploitation observed.

How to fix it

Apply kernel patch cd9f7bf6cad8b2d3876105ce3c9fc63460a046f6 or later; update affected packages such as python-qt5 to 5.15.0-2.el8, qgnomeplatform to 0.7.1-2.el8, adwaita-qt to 1.2.1-3.el8, and sip to 4.19.24-2.el8 on Rocky Linux 8 systems.

How to confirm the fix worked

Verify kernel source contains the NULL check after cpufreq_cpu_get call; confirm updated package versions are installed and test cpufreq operations on AMD hardware.

Typical attack path

1. Obtain local access on target AMD Linux system
2. Invoke cpufreq operations that reach amd-pstate driver
3. Cause cpufreq_cpu_get to return NULL
4. Trigger NULL dereference resulting in kernel fault

How to detect it

Review kernel logs for NULL dereference faults in cpufreq or amd-pstate modules; examine system crash dumps for calls involving cpufreq_cpu_get.

What your security team should do

• Prioritize kernel updates on AMD Linux systems within maintenance windows
• Monitor for kernel oops or panic logs related to cpufreq
• Test frequency scaling functionality post-update